Web App Pentest
Authentication, authorization, business logic, injections, SSRF, XSS, race conditions. Black, grey and white-box.
Typical timeline: 5–15 dias
More on web app pentesting →
Offensive security boutique · Brazil · Europe · US
Penetration testing for companies, led by senior experts.
We test web applications, APIs, cloud and AI systems for companies across the US, Europe and Brazil the way a real attacker would — and deliver a report your board understands and your team can act on.
final-report.pdf · Finding PM-2026-014
CRITICAL · CVSS 9.8
Indirect prompt injection via RAG → customer data exfiltration
POST /api/v2/assistant/chat {"message": "Summarize the attached document"} → agent invokes tool export_customers() → 12,480 records returned to an anonymous user
12+years in offensive security
400+pentests delivered
1.900+critical findings reported
92client satisfaction
Industries served
Fintechs and digital banksHealthtechB2B SaaSE-commerce and retailAI platforms
Services
Offensive security and resilience. One standard: find what automated tools don't.
Every engagement is manual, led by a senior expert and accelerated by AI and in-house tooling.
API Pentest
REST, GraphQL, gRPC and webhooks. BOLA/IDOR, mass assignment, rate limiting, JWT/OAuth, logic abuse.
Typical timeline: 5–10 dias
More on API pentesting →
Specialty
AI / LLM Pentest
Direct and indirect prompt injection, jailbreaks, data leakage via RAG, tool and agent abuse, model DoS, model supply chain.
Typical timeline: 5–12 dias
More on AI pentesting →
Cloud & External Infra
Exposed surface, AWS/Azure/GCP configuration, Kubernetes, leaked secrets, escalation paths.
Typical timeline: 5–10 dias
DDoS Testing
Controlled simulations to assess how applications and APIs withstand availability attacks. We validate protections, continuity of critical flows and team response.
Authorized scope, defined limits and coordination with your providers.
AI / LLM Pentest
Your chatbot, copilot or agent is already in production. Has anyone tried to break it?
AI systems create a new attack surface: natural language becomes an attack vector and every tool connected to the model becomes a path to data and actions. We test the whole system — model, prompts, RAG, tools, agents and integrations — with a reproducible PoC for every finding.
Test my AI system More on AI pentesting →- Direct and indirect prompt injectionThrough users, documents, emails, web pages and tool results.
- Data and system prompt leakageExtraction of secrets, PII and cross-tenant RAG context.
- Tool and agent abuseUnauthorized actions, escalation via function calling, agent-driven SSRF.
- Jailbreaks and guardrail bypassProhibited content, fraud, manipulation of automated decisions.
- RAG poisoning and supply chainPoisoning of knowledge bases, models and third-party dependencies.
- Model DoS and cost abuseToken exhaustion, agent loops, denial of wallet.
Why Pentest Machine
Senior humans. AI working for them. Never the other way around.
01
Certified experts
Every test is run by professionals holding OSCP, OSWE, OSEP, CRTO e BSCP with a track record in bug bounty and published CVEs.
02
AI + in-house tooling
AI agents and internal tooling widen recon and triage coverage, freeing the expert for what needs creativity: logic, chaining and exploitation.
03
A report that drives action
Executive summary for the board, technical detail with PoC for the team, a prioritized remediation plan and a retest included in the price.
Methodology
Six steps, zero surprises.
01
Scope & NDA
Rules of engagement, testing windows, emergency contacts.
02
Recon
Surface mapping with AI and in-house tooling.
03
Exploitation
Manual, creative, chained. Critical alerts within 24h.
04
Post-exploitation
Real business impact, not just CVSS.
05
Report
Executive + technical, PoC and remediation plan.
06
Retest
Fix validation and final attestation.
Aligned with
OWASP WSTGOWASP ASVSOWASP LLM Top 10PTESNIST SP 800-115ISO 27001PCI-DSSBACENLGPDGDPRSOC 2
“In three days the team chained an authorization flaw in the API with a prompt injection in our assistant and reached customer data. The report was straight to the point, the board understood the risk on first read, and the retest confirmed the fixes before our PCI audit.”
Rafael M.CISO, central-bank-regulated fintech
Frequently asked questions
What everyone asks before hiring a pentest.
How much does a pentest cost?
It depends on scope: number of applications, endpoints, authenticated functionality and whether AI systems are involved. A mid-size web application pentest usually takes 5 to 15 working days. We send a fixed-price proposal within 24h of understanding the scope.
What is the difference between a vulnerability scan and a pentest?
A scanner automates the search for known patterns and produces false positives. A pentest is run by an expert who exploits logic flaws, chains vulnerabilities and proves real impact with a PoC — which PCI-DSS, SOC 2 and ISO 27001 audits expect.
What is an AI / LLM pentest?
Security testing of chatbots, copilots and agents: direct and indirect prompt injection, data leakage via RAG, tool and agent abuse, jailbreaks and model DoS, following the OWASP Top 10 for LLM and MITRE ATLAS. We test the whole system, not just the model.
Is the retest included?
Yes. Once your team fixes the findings, we validate the fixes and issue a final attestation — at no extra cost, within 90 days of report delivery.
Do you sign NDAs and work outside the US?
Yes. We sign an NDA before any scope detail, work in English, Portuguese and Spanish, and invoice in the US, the EU or Brazil.
Blog
Latest articles
From the blog: offensive security in practice.
Mandatory pentesting for Central Bank of Brazil institutions: what BCB 538 and CMN 5,274 require
Independent penetration testing at least once a year. What BCB Resolution 538/2025 and CMN Resolution 5,274/2025 require, what the report must show and how to scope without paying
PHP2Shell (CVE-2026-109618 and CVE-2026-109619): what to do now about your PHP
Two critical flaws in the PHP core allow unauthenticated RCE and memory disclosure. Fixed versions, mitigations, secret rotation and an ordered checklist.
php2shell: how LFI, upload and filter chains turn into RCE in PHP
Defensive guide to php2shell: how LFI, insecure upload, phar and PHP filter chains turn into RCE, real CVEs and public tools to validate and fix.
Request a quote
Get a proposal within 24h.
Tell us what you need tested. An expert — not a salesperson — replies with scope, timeline and price.
- NDA available before any detail is shared
- Support in EN, PT and ES
- Invoicing in the US, EU or Brazil
We call you
Prefer that we call you?
Leave your number and an expert calls you back — no mandatory sales call.
Newsletter
Get our articles
Offensive security in practice, no spam. Unsubscribe anytime.